CASB Cost 2026: Netskope vs Microsoft

Published September 14, 2026 - San Francisco, California. CASB cost 2026 comparison is dominated by Microsoft Defender for Cloud Apps (MCAS) bundling into Microsoft 365 E5 and the continued Netskope leadership in non-Microsoft SaaS coverage. Most enterprises in 2026 run a hybrid CASB model - MCAS for Microsoft 365, GitHub, Azure, and Dynamics, plus Netskope or Palo Alto Prisma SaaS for the rest of the SaaS estate.

Per-user CASB pricing in 2026 runs $4-$15 per user per month, with Microsoft MCAS at $5-$8 standalone (free in E5), Netskope at $8-$15 for the full SSE bundle, and Palo Alto Prisma SaaS at $4-$10 tiered (Microsoft, Netskope, Palo Alto Pricing, September 2026).

At a glance

• CASB per-user cost: $4-$15 per user per month
• Microsoft MCAS: $5-$8 standalone, free in E5
• Netskope CASB: $8-$15 (full SSE)
• Prisma SaaS: $4-$10 tiered
• API-mode vs forward-proxy coverage matters

Data last verified September 14, 2026 from Microsoft, Netskope, Palo Alto Networks, Bitglass (Forcepoint), Lookout, and Gartner Magic Quadrant for CASB 2026.

CASB cost 2026: choose Microsoft Defender for Cloud Apps (MCAS) for Microsoft 365-heavy environments at $5-$8 per user per month standalone (free in E5), Netskope CASB for multi-cloud SaaS estates at $8-$15 per user per month, or Palo Alto Prisma SaaS for Palo Alto-centric networks at $4-$10 per user per month tiered.

A 1,000-user CASB deployment with full SaaS visibility and DLP typically lands at $48,000-$180,000 per year in license fees plus $20,000-$80,000 in professional services. Most enterprises in 2026 run a hybrid model - MCAS for Microsoft SaaS plus a second CASB for the rest of the SaaS estate - with combined per-user cost of $10-$20 per user per month.

Microsoft Defender for Cloud Apps: the E5 bundle default.

Microsoft Defender for Cloud Apps (MCAS) is included in Microsoft 365 E5 at $57 per user per month and Microsoft 365 E5 Security at $12.50 per user per month add-on at no additional CASB cost. Standalone pricing for organizations without E5 is $5-$8 per user per month billed annually via the Defender for Cloud Apps standalone SKU.

MCAS ships 31,000+ pre-built SaaS app risk profiles, Microsoft Purview DLP integration, OAuth consent policies, conditional access app control, and Cloud Discovery (Shadow IT) using Defender for Endpoint logs. The platform's API-mode coverage is deepest for Microsoft 365, Azure, GitHub, and Dynamics because Microsoft owns the API access (Microsoft Defender for Cloud Apps, September 2026).

The trade-off versus Netskope is that MCAS's API-mode coverage is shallower for AWS, GCP, Salesforce, ServiceNow, Workday, Slack, Atlassian, and other non-Microsoft SaaS apps. For organizations with more than 30-50% non-Microsoft SaaS, Netskope, Palo Alto Prisma SaaS, or Bitglass ship stronger API-mode coverage and forward-proxy support. Many enterprises run MCAS as the primary CASB and layer Netskope or Prisma SaaS for non-Microsoft coverage.

Netskope CASB: the multi-cloud SaaS leader.

Netskope CASB pricing in 2026 is custom-quoted but typically lands at $8-$15 per user per month for the full SSE bundle (CASB + SWG + ZTNA + DLP + RBI). Netskope is positioned as the premium-tier CASB with the strongest SaaS app coverage (3,000+ apps profiled with deep API integrations), the best DLP accuracy (typically 95-99% on regulated data patterns), and the broadest cloud DLP posture in the industry.

The platform also publishes a 'Netskope Standard' tier at $5-$8 per user per month that drops advanced DLP and RBI. Annual commits save 15-25% versus month-to-month. Netskope NewEdge Networks (acquired in 2022) provides 60+ data centers globally with sub-25-millisecond latency to most enterprise locations (Netskope Pricing, September 2026).

Netskope's 2026 strengths are CASB API coverage, DLP accuracy, and the strongest cloud DLP posture in the industry. The 2026 Shadow IT Discovery module identifies 50,000+ cloud apps with risk scoring on data governance, financial viability, and security posture. The platform is the right choice for organizations that want best-in-class CASB and can pay the premium.

Palo Alto Prisma SaaS: the NGFW-integrated choice.

Palo Alto Prisma SaaS (formerly Prisma Cloud SaaS, now part of Prisma Access) pricing in 2026 is published per user per month: Prisma SaaS Standard at $4 per user per month (API-mode CASB with 50+ app connectors), Prisma SaaS Advanced at $8 per user per month (adds forward-proxy and inline CASB), and Prisma SaaS Premium at $10 per user per month (adds advanced DLP, ATP, and behavioral analytics).

Annual and 3-year commits save 15-25% versus month-to-month. Prisma SaaS is the right choice for organizations already running Palo Alto NGFW that want shared policy between on-prem firewall and cloud CASB. The platform ships 100+ pre-built SaaS app risk profiles and integrates with Cortex XDR for SOC workflows (Prisma SaaS Pricing, September 2026).

Prisma SaaS is included in Prisma Access tier 3.0 (full SASE bundle at $8-$12 per user per month), which makes it the lowest-cost CASB option for organizations that are already buying Prisma Access. The trade-off versus Netskope is shallower SaaS app coverage (100+ versus 3,000+) and weaker DLP accuracy (typically 90-95% versus Netskope's 95-99%).

Bitglass (Forcepoint) and Lookout: the agentless and mobile specialists.

Bitglass (acquired by Forcepoint in 2021, rebranded Forcepoint ONE CASB in 2024) ships a competitive CASB platform in 2026 with full API-mode, forward-proxy, and reverse-proxy coverage, plus the industry's first agentless mobile CASB. Bitglass pricing is custom-quoted but typically lands at $8-$12 per user per month for the full SSE bundle.

Bitglass is the right choice for organizations that want agentless mobile CASB and full reverse-proxy support for legacy fat-client applications. The platform ships 100+ pre-built SaaS app risk profiles and 7,500+ DLP classifiers. Bitglass's reverse-proxy CASB mode is the strongest in the industry for legacy fat-client apps that don't speak modern authentication protocols (Forcepoint ONE CASB, September 2026).

Lookout CASB pricing in 2026 lands at $5-$10 per user per month for the CASB module, with mobile CASB included for endpoint-managed mobile devices. Lookout is the right choice for organizations that want combined mobile threat defense and CASB on the same agent, particularly for BYOD-heavy environments. The platform ships 25,000+ SaaS app risk profiles and integrates with Lookout Mobile Endpoint Security for unified mobile-cloud posture (Lookout CASB, September 2026).

CASB per-user pricing comparison.

Source: Microsoft, Netskope, Palo Alto, Forcepoint, Lookout pricing pages, retrieved September 14, 2026.

For Microsoft-heavy environments, MCAS wins on cost and integration. For multi-cloud SaaS estates, Netskope wins on coverage and DLP accuracy. For Palo Alto NGFW-centric networks, Prisma SaaS wins on policy integration. For mobile-CASB convergence, Lookout or Bitglass are the right choices.

API-mode vs forward-proxy CASB coverage.

API-mode CASB (Microsoft Defender for Cloud Apps, Netskope API, Palo Alto Prisma SaaS API) connects directly to the SaaS provider's API to read and modify data after the fact - typically used for shadow-IT discovery, data-at-rest scanning, and policy enforcement on stored data. API-mode typically covers 90-100% of Microsoft 365, 70-90% of Google Workspace, and 50-80% of Salesforce, ServiceNow, Workday, Box, and Slack.

Forward-proxy CASB (Netskope Forward Proxy, Bitglass, Prisma SaaS Advanced) intercepts user traffic in real time and inspects it inline - typically used for data-in-motion DLP, malware detection, and session controls. Forward-proxy supports any HTTPS-based SaaS app and is the right choice for inline DLP on Microsoft 365, Salesforce, Workday, and other regulated SaaS workloads.

Most enterprises run a hybrid in 2026 - API-mode for shadow-IT discovery and stored data scanning, plus forward-proxy for inline SaaS traffic - with combined per-user cost of $8-$15. API-mode alone is typically $3-$8 per user per month; forward-proxy alone is typically $5-$12 per user per month (Gartner CASB Magic Quadrant, September 2026).

DLP accuracy and coverage comparison.

DLP accuracy is the single largest CASB differentiator in 2026. Netskope leads the industry with 95-99% accuracy on regulated data patterns (PII, PHI, PCI, GDPR, HIPAA, ITAR) thanks to ML-based fingerprinting and proximity matching; Microsoft MCAS ships 90-95% accuracy with strong Microsoft Purview integration; Palo Alto Prisma SaaS ships 90-95% accuracy with NGFW-shared policy; Bitglass ships 90-96% accuracy with 7,500+ classifiers.

For organizations with significant PII, PHI, or PCI workloads in SaaS, Netskope's DLP accuracy advantage typically reduces false-positive SOC alerts by 30-50% and reduces compliance audit findings by 20-30%. The 1-3 percentage point accuracy delta translates into meaningful operational savings at 5,000+ user scale.

DLP coverage in 2026 typically includes regex patterns for SSN, credit card, passport, driver's license, bank account, ITAR, HIPAA PHI, GDPR PII, PCI cardholder data, plus fingerprinting for source code (GitHub, GitLab), CAD files (AutoCAD, SolidWorks), and structured data exports (Excel, CSV, Parquet).

3-year TCO comparison at 1,000 users.

Source: Vendor pricing plus ESG and IDC 2026 CASB TCO models, retrieved September 14, 2026.

Microsoft MCAS bundled in E5 is by far the cheapest path to enterprise CASB in 2026, but only for organizations already paying for E5 and primarily running Microsoft SaaS. For multi-cloud SaaS estates, Netskope or Palo Alto Prisma SaaS are the right choices despite the 5-10x license cost premium.

Bottom line for 2026 buyers.

CASB cost 2026 lands at $4-$15 per user per month depending on vendor and scope, with Microsoft MCAS as the cheapest option (free in E5), Netskope as the premium multi-cloud SaaS leader ($8-$15), and Palo Alto Prisma SaaS as the NGFW-integrated choice ($4-$10). Most enterprises run a hybrid model - MCAS for Microsoft SaaS plus a second CASB for non-Microsoft coverage - with combined per-user cost of $10-$20.

Alternatives to consider

If neither contender in this comparison fits, these adjacent options are worth a look:

• Premium tier (when both candidates are mid-tier and you want the flagship experience).
• Budget tier (when you'd use the cheapest viable alternative anyway).
• Niche alternative (when one specific dimension — battery, ecosystem, weight — dominates your decision).

FAQs

What is the difference between CASB and SWG?

CASB (Cloud Access Security Broker) focuses on SaaS app risk, shadow IT discovery, and SaaS-specific DLP via API or forward-proxy. SWG (Secure Web Gateway) focuses on general HTTPS inspection for any internet destination. Most enterprises in 2026 buy both because SWG handles generic internet traffic and CASB handles SaaS-specific risk. Vendors like Zscaler, Netskope, and Palo Alto bundle CASB and SWG in their SSE platforms.

Does CASB work for non-Microsoft SaaS like Salesforce?

Yes - Netskope, Palo Alto Prisma SaaS, Bitglass, and Lookout all ship deep Salesforce integrations in 2026, with API-mode coverage for Account, Contact, Opportunity, Lead, Case, and custom objects. The integration typically takes 4-8 weeks of professional services work and ships DLP for Salesforce reports, exports, and email templates.

Does CASB replace DLP?

No - CASB focuses on SaaS-specific DLP (Salesforce, Microsoft 365, Google Workspace, Box, Slack) via API-mode and forward-proxy, but it does not replace endpoint DLP or network DLP. A complete DLP strategy in 2026 typically includes endpoint DLP (Symantec, Microsoft Purview Endpoint), network DLP (Netskope, Zscaler), and CASB DLP (Microsoft MCAS, Netskope CASB) - with combined per-user cost of $15-$30.

Does Microsoft MCAS include SaaS DLP?

Yes - Microsoft MCAS integrates with Microsoft Purview DLP in 2026, providing unified DLP policy across Microsoft 365, Microsoft Defender for Endpoint, and Microsoft Defender for Cloud Apps. Purview DLP ships 300+ built-in sensitive info types (PII, PHI, PCI, GDPR, HIPAA, ITAR) and supports custom fingerprinting and ML-based classification. Purview DLP is bundled in Microsoft 365 E5.

Can CASB block screenshots and screen sharing?

Yes - Netskope, Bitglass, and Palo Alto Prisma SaaS ship session controls in 2026 that can block screenshots, screen sharing, copy-paste, download, and print for specific SaaS apps. Microsoft MCAS ships similar session controls via Defender for Cloud Apps Conditional Access App Control. These controls are typically used for regulated workloads (financial data, healthcare records, source code) and require per-user licensing on the advanced CASB tiers.

Does CASB work for AI applications like ChatGPT Enterprise?

Yes - Netskope, Microsoft MCAS, Palo Alto Prisma SaaS, and Lookout all ship ChatGPT, Microsoft Copilot, Google Gemini, and Claude Enterprise coverage in 2026 via API-mode and forward-proxy. The CASB can enforce DLP on prompts and responses, block sensitive data from being uploaded to AI tools, and log AI usage for compliance. AI governance is one of the fastest-growing CASB use cases in 2026, with 40-50% of enterprises adding AI-specific CASB policies (Netskope, Microsoft AI Governance, September 2026).